Draft v0.1.06 of 6 frameworks
Data retention, media handling and secure disposal
Data is retained only as long as needed, media is controlled, and data and equipment are securely destroyed.
Where it appears
- SOC 2
CC6.5Discontinues logical and physical protections over assets only after the ability to read or recover data is diminishedC1.2Disposes of confidential information- PCI DSS 4.0
3.2Storage of account data is kept to a minimum (3.2.1 retention and disposal)9.4Media with cardholder data is securely stored, accessed, distributed and destroyed- NIST CSF 2.0
ID.AM-08Systems, hardware, software, services and data are managed throughout their life cycles- ISO 27001:2022
A.7.10Storage mediaA.7.14Secure disposal or re-use of equipmentA.8.10Information deletion- HIPAA Security Rule
164.310(d)(2)(i)Disposal164.310(d)(2)(ii)Media re-use- NIST 800-53 r5
MP-6Media sanitizationSI-12Information management and retention
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Data retention and disposal policy / schedule
- Certificates of destruction or media sanitization records
- Evidence of automated deletion or quarterly purge of data past retention
- Equipment disposal / re-use procedures
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0